- Hosting: PHI resides in HIPAA-compliant U.S. data centers managed by Vercel and Turso.
- Datacenter Controls: Vendors enforce 24/7 monitoring, biometric access, and video surveillance.
- Workstations: No PHI stored locally. Devices are encrypted, password-protected, and auto-lock after inactivity.
- Hosting: PHI resides in HIPAA-compliant U.S. data centers managed by Vercel and Turso.
- Datacenter Controls: Vendors enforce 24/7 monitoring, biometric access, and video surveillance.
- Workstations: No PHI stored locally. Devices are encrypted, password-protected, and auto-lock after inactivity.
- Encryption: TLS 1.2+ for all data in transit; AES-256 encryption at rest.
- Authentication: MFA required for administrative and privileged accounts. Unique user IDs for all staff.
- Audit Logging: Detailed logs of system and data access maintained and reviewed.
- Data Segregation: Logical separation of client environments; no co-mingling.
- Monitoring: Vendors perform vulnerability scanning, patching, and intrusion detection.